Commit 302a50bc941010d7a67f288fd0db31981e4d722d
1 parent
9c9c9ad5fa
Exists in
smarc-imx_3.14.28_1.0.0_ga
and in
1 other branch
xfrm: Fix potential null pointer dereference in xdst_queue_output
The net_device might be not set on the skb when we try refcounting. This leads to a null pointer dereference in xdst_queue_output(). It turned out that the refcount to the net_device is not needed after all. The dst_entry has a refcount to the net_device before we queue the skb, so it can't go away. Therefore we can remove the refcount on queueing to fix the null pointer dereference. Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Showing 1 changed file with 1 additions and 8 deletions Side-by-side Diff
net/xfrm/xfrm_policy.c
| ... | ... | @@ -320,10 +320,8 @@ |
| 320 | 320 | { |
| 321 | 321 | struct sk_buff *skb; |
| 322 | 322 | |
| 323 | - while ((skb = skb_dequeue(list)) != NULL) { | |
| 324 | - dev_put(skb->dev); | |
| 323 | + while ((skb = skb_dequeue(list)) != NULL) | |
| 325 | 324 | kfree_skb(skb); |
| 326 | - } | |
| 327 | 325 | } |
| 328 | 326 | |
| 329 | 327 | /* Rule must be locked. Release descentant resources, announce |
| ... | ... | @@ -1758,7 +1756,6 @@ |
| 1758 | 1756 | struct sk_buff *skb; |
| 1759 | 1757 | struct sock *sk; |
| 1760 | 1758 | struct dst_entry *dst; |
| 1761 | - struct net_device *dev; | |
| 1762 | 1759 | struct xfrm_policy *pol = (struct xfrm_policy *)arg; |
| 1763 | 1760 | struct xfrm_policy_queue *pq = &pol->polq; |
| 1764 | 1761 | struct flowi fl; |
| ... | ... | @@ -1805,7 +1802,6 @@ |
| 1805 | 1802 | dst = xfrm_lookup(xp_net(pol), skb_dst(skb)->path, |
| 1806 | 1803 | &fl, skb->sk, 0); |
| 1807 | 1804 | if (IS_ERR(dst)) { |
| 1808 | - dev_put(skb->dev); | |
| 1809 | 1805 | kfree_skb(skb); |
| 1810 | 1806 | continue; |
| 1811 | 1807 | } |
| 1812 | 1808 | |
| ... | ... | @@ -1814,9 +1810,7 @@ |
| 1814 | 1810 | skb_dst_drop(skb); |
| 1815 | 1811 | skb_dst_set(skb, dst); |
| 1816 | 1812 | |
| 1817 | - dev = skb->dev; | |
| 1818 | 1813 | err = dst_output(skb); |
| 1819 | - dev_put(dev); | |
| 1820 | 1814 | } |
| 1821 | 1815 | |
| 1822 | 1816 | return; |
| ... | ... | @@ -1839,7 +1833,6 @@ |
| 1839 | 1833 | } |
| 1840 | 1834 | |
| 1841 | 1835 | skb_dst_force(skb); |
| 1842 | - dev_hold(skb->dev); | |
| 1843 | 1836 | |
| 1844 | 1837 | spin_lock_bh(&pq->hold_queue.lock); |
| 1845 | 1838 |